PCI compliance

[Killer_Rubber_Ducky]

I was working at a Call center and we had to be PCI compliant. I understand the importance of PCI compliance but am curious about some of the policies put in place.
Almost every day there are times of blue (when there are no calls) and we are not allowed to talk to coworkers as they may be on the phone. (makes sense)

One of the "PCI compliance" policies in effect was the banning of reading material of any form from the call floor. I mean LOTR, PC World, etc. What does that have to do with PCI compliance? How is preventing us from reading a chapter or 2 when we have blue since we are banned from surfing the web, securing data? Electronic devices were banned of course so no Nook or Kindles.(given)

[Kreij]

It's not "in-scope with PCI requirements, however ...

Do we need a 'clean room?'

From a PCI compliance perspective, the answer is ‘no’, although there are a number of PCI requirements that would lead you to restrict what is in the actual call center. However, best practice is to operate any call center handling potentially sensitive data in a ‘sterile’ environment.

That means clean desks, no personal items at the workstation, no paper and pens for writing things down, locked down workstations and other restrictions so that sensitive information is not leaked from the call center.
The idea for creating a sterile environment by banning cell phones and giving personnel lockers to secure their personal items is in line with what we see in call centers. In addition, I think most call center organizations find that their clients require such approaches to ensure that their customers’ privacy and security is maintained.

In addition to all of the physical security, call center personnel need to be trained regarding security and privacy. Call center personnel need to sign an agreement that says they acknowledge that they will be in contact with cardholder data and that the cardholder data is to be protected in compliance with the PCI DSS and other regulatory and legal requirements.

If your employer wants a "sterile" environment that is up to them and you have to put up with it if you want to work there.

[Killer_Rubber_Ducky]

Originally Posted by Kreij

It's not "in-scope with PCI requirements, however ...


If your employer wants a "sterile" environment that is up to them and you have to put up with it if you want to work there.

thanks. It just seemed odd that a week before the audit they banned personal items. I no longer work for them but it seemed odd.

[remixedcat]

Please respect those guidelines. I work with a hosting company that's PCI-Compliant as well called inetu that has a very secure datacenter.